The vulnerability CVE-2025-26887 affects the Eli EZ SQL Reports Shortcode Widget and DB Backup plugin through improper input neutralization during web page generation, leading to stored cross-site scripting (XSS). This allows an attacker with low privileges and requiring user interaction to inject malicious scripts that can impact confidentiality, integrity, and availability to a limited extent. The issue affects all versions up to 5.21.35. There is no vendor advisory or patch information available at this time.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to limited confidentiality, integrity, and availability impacts. The attack requires low privileges and user interaction, which limits the ease of exploitation. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with input handling and consider restricting access to the affected plugin features. Monitor for vendor updates regarding patches or official mitigations.